Configuring User Roles

In the user-centric network, the user role of a wireless client determines its privileges and the type of traffic that it can send or receive in the wireless network. You can configure roles for clients that use mostly data traffic, such as laptops, and roles for clients that use mostly voice traffic, such asVoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network.phones. Although there are different ways for a client to derive a user role, in most cases the clients using data traffic are assigned a role after they are authenticated through a method such as802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority.,VPNVirtual Private Network. VPN enables secure access to a corporate network when located remotely. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security, and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two., orcaptive portalA captive portal is a web page that allows the users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users.. The user role forVoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network.phones may also be derived from theOUIOrganizationally Unique Identifier. Synonymous with company ID or vendor ID, an OUI is a 24-bit, globally unique assigned number, referenced by various standards. The first half of a MAC address is OUI.of theirMACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network.addresses or theSSIDService Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network.to which they associate. Refer toRoles and Policiesfor details on how to create and configure a user role.

This section describes how to configure voice user roles with the required privileges and priorities.Managed Deviceprovides default user roles for all voice services. You can do one of the following:

Using the Default User Role

Creating or Modifying Voice User Roles

Using the User-Derivation Rules

Using the Default User Role

Managed Deviceis configured with the default voice role. This role has the following settings:

No limit on upload or download bandwidth

DefaultL2TPLayer-2 Tunneling Protocol. L2TP is a networking protocol used by the ISPs to enable VPN operations.andPPTPPoint-to-Point Tunneling Protocol. PPTP is a method for implementing virtual private networks. It uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets.pool

Maximum sessions: 65535

The followingACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.are associated with the default voice role:

global-sacl

apprf-voice-sacl

ra-guard

sip-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

noe-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

svp-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

vocera-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

skinny-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

h323-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

dhcp-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

tftp-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

dns-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

icmp-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

http-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

https-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

skype4b-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

jabber-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

wificalling-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

voip-applications-aclAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.

For more details on the default voice role, enter the following command in theMobility Master:

(host) [mynode] #show rights voice

Creating or Modifying Voice User Roles

You can create roles for Facetime, H.323, Jabber,NOENew Office Environment. NOE is a proprietary VoIP protocol designed by Alcatel-Lucent Enterprise., SCCP, Skype for Business,SIP会议Initiation Protocol. SIP is used for signaling and controlling multimedia communication session such as voice and video calls.,SVPSpectraLink Voice Priority. SVP is an open, straightforward QoS approach that has been adopted by most leading vendors of WLAN APs. SVP favors isochronous voice packets over asynchronous data packets when contending for the wireless medium and when transmitting packets onto the wired LAN.，vocera和Wi-FiWi-Fi is a technology that allows electronic devices to connect to a WLAN network, mainly using the 2.4 GHz and 5 GHz radio bands. Wi-Fi can apply to products that use any 802.11 standard.calling ALGs. The following procedure describes how to configure user roles for any of the ALGs:

1.In theManaged Networknode hierarchy, navigate toConfiguration > Roles & Policies.

2.In thePoliciestab, click+to add a policy.

3.ForPolicy Name, enter a name.

4.ForPolicy Type, select会议.

5.ClickSubmit.

6.Select the newly added policy.

7.InPolicies > , click+to add a new rule.

8.SelectAccess Controloption as the rule type.

9.ClickOK.

10.UnderRoles, configure the following settings:

a.ForIP version, selectIPv4.

b.ForSource, selectany.

c.ForDestination, selectany.

d.ForService/app, select service, then the correct voice or videoALGApplication Layer Gateway. ALG is a security component that manages application layer protocols such as SIP, FTP and so on.service. SeeTable 1andTable 2for service names for all ALGs:

Table 1:Services for ALGs

ALG	Service Name
NOENew Office Environment. NOE is a proprietary VoIP protocol designed by Alcatel-Lucent Enterprise.	svc-noe sip-noe-oxo
SIP会议Initiation Protocol. SIP is used for signaling and controlling multimedia communication session such as voice and video calls.	svc-sip-tcp svc-sip-udp
SIPS	svc-sips
SVPSpectraLink Voice Priority. SVP is an open, straightforward QoS approach that has been adopted by most leading vendors of WLAN APs. SVP favors isochronous voice packets over asynchronous data packets when contending for the wireless medium and when transmitting packets onto the wired LAN.	svc-svp
VOCERA	svc-vocera
SCCP	svc-sccp
H.323	svc-h323-tcp svc-h323-udp

Table 2:Other Services for the ALGs

ACL	Service Name
DHCPDynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network.	svc-dhcp
TFTPTrivial File Transfer Protocol. The TFTP is a software utility for transferring files from or to a remote host.	svc-tftp
ICMPInternet Control Message Protocol. ICMP is an error reporting protocol. It is used by network devices such as routers, to send error messages and operational information to the source IP address when network problems prevent delivery of IP packets.	svc-icmp
DNS域名系统。DNS服务器功能作为ph值one book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element.	svc-dns

e.ForAction, selectpermit.

f.For802.1p priority, select a value. -- denotes lowest priority. 7 denotes highest priority.

g.ClickSubmit. Repeat steps 1 to 5 to addACLsAccess Control List. ACL is a common way of restricting certain types of traffic on a physical port.for moreVoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network.protocols.

11.Select theRolestab. Click+to add a user role.

12.In theNew Rolewindow, forName, enter a name for the user role.

13.ClickSubmit.

14.Select the newly added role.

15.In theRoles > section, clickShow Advanced View. Configure the following settings:

a.UnderPolicies, click+.

b.In theAdd Policywindow, select theAdd an existing policyoption.

c.In thePolicy namedrop-down list, select the previously-configured policy name.

d.ClickSubmit.

e.UnderPolicies, click+.

f.In theAdd Policywindow, select theAdd an existing policyoption.

g.In thePolicy namedrop-down list, selectcontrol.

h.ClickSubmit.

16.ClickPending Changes.

17.In thePending Changeswindow, select the check box and clickDeploy changes.

The followingCLICommand-Line Interface. A console interface with a command line shell that allows users to execute text input as commands and convert these commands to appropriate functions.commands configure user roles for ALGs:

(host) [md] (config) #ip access-list session

(host) ^[md] (config-submode) #any any permit queue high

The followingCLICommand-Line Interface. A console interface with a command line shell that allows users to execute text input as commands and convert these commands to appropriate functions.commands map the policy name to the user role:

(host) [md] (config) #user-role

(host) ^[md] (config-submode) #access-list session

Replace the following strings:

policy-namewith a string that you want to identify the roles policy

role-name名字要一致格fy the voice user role

service-namewith any of the service names from

Using the User-Derivation Rules

The user role can be derived from the attributes of the client association with an AP. ForVoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network.phones, you can configure the devices to be placed in their user role based on theSSIDService Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network.or theOUIOrganizationally Unique Identifier. Synonymous with company ID or vendor ID, an OUI is a 24-bit, globally unique assigned number, referenced by various standards. The first half of a MAC address is OUI.of theMACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network.客户的地址。以下过程描述了如何根据SSIDService Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network.:

User-derivation rules are executedbeforethe client is authenticated.

1.In theManaged Networknode hierarchy, navigate toConfiguration > Authentication > User Rules.

2.InUser Rules Summary, click+.

3.In the添加新用户规则window, enter a name for the user rule and clickSubmit.

4.InUser Rules Summary, select the name of the user rule to configure the rule set.

5.InRules-set, click+and configure the following settings:

a.ForSet type, selectRolefrom the drop-down list.

b.ForRule type, selectESSID.

c.ForCondition, selectequals.

d.ForValue, enter theSSIDService Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network.used for the phones.

e.ForRoles, select the user role previously created.

6.ClickSubmit.

7.ClickPending Changes.

8.In thePending Changeswindow, select the check box and clickDeploy changes.

Run the following commands to derive a role based onSSIDService Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network.:

(host) [md] (config) #aaa derivation-rules user

(host) ^[md] (config-submode) #set role condition essid equalsset-value

Deriving Role Based on MAC OUI

The following procedure describes how to derive a role based onMACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network.OUIOrganizationally Unique Identifier. Synonymous with company ID or vendor ID, an OUI is a 24-bit, globally unique assigned number, referenced by various standards. The first half of a MAC address is OUI.:

1.In theManaged Networknode hierarchy, navigate toConfiguration > Authentication > User Rules.

2.InUser Rules Summary, click+.

3.In the添加新用户规则window, enter a name for the user rule and clickSubmit.

4.InUser Rules Summary, select the name of the user rule to configure the rule set.

5.InRules-set, click+and configure the following settings:

a.ForSet type, selectRolefrom the drop-down list.

b.ForRule type, selectMAC Address.

c.ForCondition, selectcontains.

d.ForValue, enter the first three octets (theOUIOrganizationally Unique Identifier. Synonymous with company ID or vendor ID, an OUI is a 24-bit, globally unique assigned number, referenced by various standards. The first half of a MAC address is OUI.) of theMACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network.address of the phones (for example, the SpectralinkOUIOrganizationally Unique Identifier. Synonymous with company ID or vendor ID, an OUI is a 24-bit, globally unique assigned number, referenced by various standards. The first half of a MAC address is OUI.is 00:09:7a)

e.ForRoles, select the user role previously created.

6.ClickSubmit.

7.ClickPending Changes.

8.In thePending Changeswindow, select the check box and clickDeploy changes.

Run the following commands to derive a role based onMACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network.OUIOrganizationally Unique Identifier. Synonymous with company ID or vendor ID, an OUI is a 24-bit, globally unique assigned number, referenced by various standards. The first half of a MAC address is OUI.:

(host) [md] (config) #aaa derivation-rules user

(host) ^[md] (config-submode) #set role condition macaddr containsset-value